This hunt identifies potential Havoc C2 framework activity by matching known Indicators of Compromise, which adversaries often use to establish persistent, low-noise command and control channels. Proactively hunting for these IOCs in Azure Sentinel allows the SOC to detect and isolate compromised assets before the attacker can leverage the Havoc framework for lateral movement or privilege escalation.
Malware Family: Havoc Total IOCs: 2 IOC Types: ip:port
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| ip:port | 104[.]164[.]46[.]36:10443 | botnet_cc | 2026-09-14 | 75% |
| ip:port | 16[.]5[.]7[.]159:22 | botnet_cc | 2026-09-14 | 100% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Havoc
let malicious_ips = dynamic(["104.164.46.36", "16.5.7.159"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["104.164.46.36", "16.5.7.159"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
Scenario: A network operations center (NOC) engineer deploys a new version of the Havoc C2 framework in an isolated staging environment to validate configuration changes before a production rollout. The specific IP address or domain hash associated with the Havoc beacon is temporarily added to the internal DNS or firewall allowlist, but the IOC detection rule still triggers on the initial connection handshake.
10.50.0.0/24) and the destination port matches the known Havoc beacon port (e.g., 443 or 8080), provided the user account is tagged with the noc-staging group.Scenario: An IT administrator runs a scheduled PowerShell script using PSEXEC to push a security patch to a fleet of Windows servers. The script inadvertently uses a temporary listening port or a specific hash value that collides with one of the two IOCs in the ThreatFox package due to a generic default configuration in the patching tool.
PSEXEC.exe or PsExec.exe and the parent process is powershell.exe or cmd.exe, and the alert occurs during the defined maintenance window (e.g., 02:00–04:00 UTC).Scenario: A DevOps team uses Ansible to configure a new Kubernetes node, which involves creating a temporary SSH tunnel or using a specific container image hash that matches one of the Havoc IOCs. The Ansible controller connects to the node over a known internal IP, but the IOC detection rule flags the container’s ephemeral network interface or the specific SHA256 hash of the pulled image.